This vulnerability affects Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7, specifically in the Siebel Cloud Manager component. It permits an unauthenticated attacker with network access via SSH to compromise the application, leading to unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. Oracle's September 2026 Critical Security Patch Update advisory references this vulnerability and includes security patches addressing it among 673 fixes. Oracle emphasizes the importance of applying patches without delay to prevent exploitation, although no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Siebel CRM Cloud Applications, compromising confidentiality. The vulnerability does not impact integrity or availability. The scope change indicates that additional Oracle products may be affected indirectly. There are no confirmed active exploits in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Oracle recommends remaining on actively supported versions and not delaying patch application to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.